Destroy PrerenderMessageFilter on the UI thread.

chrome/browser/prerender/prerender_message_filter.h

Index: chrome/browser/prerender/prerender_message_filter.h
diff --git a/chrome/browser/prerender/prerender_message_filter.h b/chrome/browser/prerender/prerender_message_filter.h
index 76ae753efcc8b620757ab93ce6bab1c25929484b..049db7dbffaa1ab08ae7f0a4335149e52e08bd6f 100644
--- a/chrome/browser/prerender/prerender_message_filter.h
+++ b/chrome/browser/prerender/prerender_message_filter.h
@@ -37,6 +37,10 @@ class PrerenderMessageFilter : public content::BrowserMessageFilter {
   static void EnsureShutdownNotifierFactoryBuilt();
 
  private:
+  friend struct content::BrowserThread::DeleteOnThread<
+      content::BrowserThread::UI>;
+  friend class base::DeleteHelper<PrerenderMessageFilter>;
+
   ~PrerenderMessageFilter() override;
 
   // Overridden from content::BrowserMessageFilter.
@@ -44,6 +48,7 @@ class PrerenderMessageFilter : public content::BrowserMessageFilter {
   void OverrideThreadForMessage(const IPC::Message& message,
                                 content::BrowserThread::ID* thread) override;
   void OnChannelClosing() override;
+  void OnDestruct() const override;
 
   void OnAddPrerender(int prerender_id,
                       const PrerenderAttributes& attributes,